Install and operate

Install with Helm

Install from OCI charts or from the repository, without the scripts.

Use this method for a cluster that the scripts do not support, or when you must control each chart.

Beta

An installation from the charts operates. The project tests it less than it tests the Kind script and the OpenShift script. Expect more manual steps.

Sentinel has three charts. Install them in this order.

Chart Contents
sentinel-deps SPIRE, cert-manager, Keycloak and the other dependencies
mcp-gateway The MCP Gateway
sentinel The operator, the webhook, the backend and the console

Method A: from the OCI charts#

Get the most recent release tag:

LATEST_TAG=$(git ls-remote --tags --sort="v:refname" \
  https://github.com/StyxLabs-Inc/sentinel.git \
  | tail -n1 | sed 's|.*refs/tags/v||; s/\^{}//')

Prepare the secrets. Get .secrets_template.yaml, save it as .secrets.yaml, and add your values.

Install the dependencies:

helm install sentinel-deps \
  oci://ghcr.io/sentinel/sentinel/sentinel-deps \
  --create-namespace -n sentinel-system \
  --version "$LATEST_TAG" \
  --set spire.trustDomain="${DOMAIN}"

Install the MCP Gateway:

LATEST_GATEWAY_TAG=$(skopeo list-tags docker://ghcr.io/sentinel/charts/mcp-gateway | jq -r '.Tags[-1]')

helm install mcp-gateway oci://ghcr.io/sentinel/charts/mcp-gateway \
  --create-namespace -n mcp-system \
  --version "$LATEST_GATEWAY_TAG"

Install Sentinel:

helm upgrade --install sentinel \
  oci://ghcr.io/sentinel/sentinel/sentinel \
  --create-namespace -n sentinel-system \
  --version "$LATEST_TAG" \
  -f .secrets.yaml \
  --set agentOAuthSecret.spiffePrefix="spiffe://${DOMAIN}/sa" \
  --set uiOAuthSecret.useServiceAccountCA=false \
  --set agentOAuthSecret.useServiceAccountCA=false

The last three settings are for OpenShift

The useServiceAccountCA=false settings and the explicit spiffePrefix value correct the certificate authority behaviour of OpenShift. Keep them on OpenShift. On a different cluster, try the command without them first.

Method B: from the repository#

git clone https://github.com/StyxLabs-Inc/sentinel.git
cd sentinel

cp charts/sentinel/.secrets_template.yaml charts/sentinel/.secrets.yaml
# Add your values to .secrets.yaml

helm dependency update ./charts/sentinel-deps/
helm dependency update ./charts/sentinel/

helm install sentinel-deps ./charts/sentinel-deps/ \
  -n sentinel-system --create-namespace \
  --set spire.trustDomain="${DOMAIN}" --wait

helm install mcp-gateway oci://ghcr.io/sentinel/charts/mcp-gateway \
  --create-namespace -n mcp-system --version 0.4.0

LATEST_TAG=$(git ls-remote --tags --sort="v:refname" \
  https://github.com/StyxLabs-Inc/sentinel.git | tail -n1 | sed 's|.*refs/tags/||; s/\^{}//')

helm upgrade --install sentinel ./charts/sentinel/ \
  -n sentinel-system --create-namespace \
  -f ./charts/sentinel/.secrets.yaml \
  --set ui.tag="${LATEST_TAG}" \
  --set agentOAuthSecret.spiffePrefix="spiffe://${DOMAIN}/sa" \
  --set uiOAuthSecret.useServiceAccountCA=false \
  --set agentOAuthSecret.useServiceAccountCA=false

The feature flags#

Set a flag during the installation, or later with the --reuse-values option:

helm upgrade sentinel ./charts/sentinel/ \
  -n sentinel-system --reuse-values \
  --set featureFlags.skills=true \
  --set featureFlags.externalSkills=true

For the function of each flag, see Skills and Agent context.

Confirm the installation#

kubectl get deployments -n sentinel-system
kubectl get daemonsets -n zero-trust-workload-identity-manager

Edit this page on GitHub